Businesses and individuals are increasingly dependent on computers and computer-based electronic communication. More and more businesses are moving toward “paperless” modes of operation, and the convenience of the Internet has resulted in individuals using electronic media for various activities, such as communicating via email, banking, paying bills, investing money and shopping, to name but a few. While businesses and individuals desire the convenience of electronic transactions, these entities also want to maintain at least the same level of security that more traditional transactional methods provide. However, in some ways, more traditional transactions are inherently more secure than electronic transactions because computers may easily be used to intercept the information being communicated between two or more computers. Accordingly, techniques have been created to secure information being communicated electronically.
Many of these techniques make use of various aspects of cryptography. Cryptography is the study of sending and/or receiving a message in a secret form so that only those authorized to receive the message are able to read it. Cryptography may be used for any form of communication, but for the purposes of this application, cryptography for electronic communication will be discussed. Examples of cryptographic techniques include symmetric encryption, asymmetric encryption and hashing. For electronic communication, an encrypted message may be transformed into a secret form using an encryption key and then may be transformed back into its original or clear form with a decryption key.
In addition to cryptographic functions for securing information, entities desiring to protect information that is stored electronically may also create defined communication relationships between components within a networked computer system and a user wishing to access services within the system. For example, a networked computer system may require that a user be authenticated before being able to receive services from an application within the networked computer system.
In a conventional networked computer system, user authentication may occur at each application server individually, i.e., each application server is responsible for authenticating a user when the user requests services from that application server. This conventional authentication process requires a user to be authenticated for each application server that it wishes to access within the networked computer system.
It is desirable to provide a more efficient, flexible and secure authentication system and method for receiving services from an application server in a networked computer system.